Version 5.2
Sourcefire 3D System Installation Guide
38
Understanding Deployment
Deployment Options
Chapter 2
Use a virtual switch where you would use a Layer 2 switch, such as workgroup
connectivity and network segmentation. Layer 2 switches are particularly
effective where workers spend most of their time on their local segment. Larger
deployments (for example, deployments that contain broadcast traffic, Voice-over-
IP, or multiple networks) can use virtual switches on smaller network segments of
the deployment.
When you deploy multiple virtual switches on the same managed device, you can
maintain separate levels of security as dictated by the needs of each network.
Virtual Switches on a Managed Device
In this example, the managed device monitors traffic from two separate
networks, 172.16.1.0/20 and 192.168.1.0/24. Although both networks are
monitored by the same managed device, the virtual switch passes traffic only to
those computers or servers on the same network. Traffic can pass from
computer A to computer B through the 172.16.1.0/24 virtual switch (indicated by
the blue line) and from computer B to computer A through the same virtual
switch (indicated by the green line). Similarly, traffic can pass to and from the file
and web servers through the 192.168.1.0/24 virtual switch (indicated by the red
and orange lines). However, traffic cannot pass between the computers and the
web or file servers because the computers are not on the same virtual switch as
the servers.
For more information on configuring switched interfaces and virtual switches, see
Setting Up Virtual Switches in the
Sourcefire 3D System User Guide
.
Deploying with a Virtual Router
L
ICENSE
:
Control
S
UPPORTED
D
EVICES
:
Series 3
You can create a
virtual router
on a managed device to route traffic between two
or more networks, or to connect a private network to a public network (for
example, the Internet). The virtual router connects two routed interfaces to
provide Layer 3 packet forwarding decisions for your deployment according to the
destination address. Optionally, you can enable strict TCP enforcement on the
virtual router. For more information on routed interfaces, see
on page 31. You must use a virtual router with a gateway VPN. For more
information, see
